如何为Azure自定义策略添加验证码功能

核心实现步骤 #

• 定义验证码相关声明：在策略的<ClaimsSchema>中添加邮箱、验证码字段的声明定义。
• 配置验证码发送逻辑：选择使用Azure B2C内置邮件服务，或自定义REST API调用第三方邮件服务（如SendGrid）发送验证码。
• 编排用户旅程：在用户旅程中加入「从token_hint提取邮箱」「发送验证码」「验证验证码」的步骤。

具体配置示例 #

1. 声明定义（扩展策略或TrustFrameworkBase.xml） #

在<ClaimsSchema>节点下添加：

<ClaimType Id="email">
  <DisplayName>Email Address</DisplayName>
  <DataType>string</DataType>
  <UserInputType>TextBox</UserInputType>
  <Restriction>
    <Pattern RegularExpression="^[a-zA-Z0-9.!#$%&amp;'^_`{}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*$" HelpText="Please enter a valid email address." />
  </Restriction>
</ClaimType>
<ClaimType Id="emailVerificationCode">
  <DisplayName>Verification Code</DisplayName>
  <DataType>string</DataType>
  <UserInputType>TextBox</UserInputType>
</ClaimType>

2. 验证码发送技术配置 #

方式一：使用Azure B2C内置邮件服务

在<ClaimsProviders>中添加以下技术配置：

<ClaimsProvider>
  <DisplayName>Email Verification</DisplayName>
  <TechnicalProfiles>
    <!-- 验证码输入与验证界面 -->
    <TechnicalProfile Id="Email-Verify">
      <DisplayName>Email Verification</DisplayName>
      <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
      <Metadata>
        <Item Key="ContentDefinitionReferenceId">api.selfasserted</Item>
        <Item Key="language.button_continue">Verify Code</Item>
      </Metadata>
      <InputClaims>
        <InputClaim ClaimTypeReferenceId="email" />
      </InputClaims>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="emailVerificationCode" Required="true" />
      </OutputClaims>
      <ValidationTechnicalProfiles>
        <ValidationTechnicalProfile ReferenceId="SendEmailVerificationCode" />
      </ValidationTechnicalProfiles>
    </TechnicalProfile>
    <!-- 发送验证码逻辑 -->
    <TechnicalProfile Id="SendEmailVerificationCode">
      <DisplayName>Send Email Verification Code</DisplayName>
      <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.EmailProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
      <Metadata>
        <Item Key="ContentDefinitionReferenceId">api.emailverification</Item>
        <Item Key="emailSubject">Your Verification Code</Item>
        <Item Key="emailBody">Your verification code is {verificationCode}</Item>
        <Item Key="recipientClaim">email</Item>
        <Item Key="verificationCodeClaim">emailVerificationCode</Item>
        <Item Key="sendEmailRetryIntervalInSeconds">60</Item>
        <Item Key="maxNumberOfSendAttempts">3</Item>
      </Metadata>
      <InputClaims>
        <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="recipient" />
      </InputClaims>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="emailVerificationCode" PartnerClaimType="verificationCode" />
      </OutputClaims>
    </TechnicalProfile>
  </TechnicalProfiles>
</ClaimsProvider>

方式二：自定义REST API发送验证码

如果需要自定义邮件内容或使用第三方服务，添加调用REST API的技术配置：

<TechnicalProfile Id="REST-SendEmailCode">
  <DisplayName>Send Verification Code via REST API</DisplayName>
  <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
  <Metadata>
    <Item Key="ServiceUrl">https://your-custom-api.com/send-verification-code</Item>
    <Item Key="AuthenticationType">None</Item>
    <Item Key="SendClaimsIn">Body</Item>
  </Metadata>
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="email" />
  </InputClaims>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="emailVerificationCode" />
  </OutputClaims>
</TechnicalProfile>

3. 用户旅程集成 #

在<OrchestrationSteps>中添加步骤，衔接token_hint取邮箱、发送验证码、验证流程：

<!-- 从token_hint提取邮箱声明 -->
<OrchestrationStep Order="1" Type="ClaimsExchange">
  <ClaimsExchanges>
    <ClaimsExchange Id="GetEmailFromTokenHint" TechnicalProfileReferenceId="GetClaimsFromTokenHint" />
  </ClaimsExchanges>
</OrchestrationStep>
<!-- 发送验证码 -->
<OrchestrationStep Order="2" Type="ClaimsExchange">
  <ClaimsExchanges>
    <ClaimsExchange Id="SendVerificationCode" TechnicalProfileReferenceId="SendEmailVerificationCode" />
  </ClaimsExchanges>
</OrchestrationStep>
<!-- 验证验证码 -->
<OrchestrationStep Order="3" Type="ClaimsExchange">
  <ClaimsExchanges>
    <ClaimsExchange Id="VerifyCode" TechnicalProfileReferenceId="Email-Verify" />
  </ClaimsExchanges>
</OrchestrationStep>

关键注意事项 #

• Token_hint解析：确保GetClaimsFromTokenHint技术配置能正确解析token中的邮箱声明，将其赋值给email声明，供后续步骤使用。
• 邮件模板配置：使用内置邮件服务时，需在Azure B2C门户配置对应邮件模板，或在技术配置中直接指定邮件内容。
• 验证码有效期：可在技术配置中设置验证码的重试间隔、最大发送次数，避免滥用或过期问题。

内容的提问来源于stack exchange，提问作者Juliyanage Silva